# AC 20-128A: Design Considerations for Minimizing Hazards caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure

- Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it)
- Status: Current
- Approved: March 25, 1997
- Last reviewed: March 22, 2017
- Family: AC 20-128
- Cancels: [AC 20-128](https://openairdocs.org/ac/20-128)
- 14 CFR parts: 23, 25
- 14 CFR sections: [23.901(f)](https://www.ecfr.gov/current/title-14/section-23.901(f)), [23.903(b)(1)](https://www.ecfr.gov/current/title-14/section-23.903(b)(1)), [25.901(d)](https://www.ecfr.gov/current/title-14/section-25.901(d)), [25.903(d)(1)](https://www.ecfr.gov/current/title-14/section-25.903(d)(1))
- Pages: 45
- PDF: https://openairdocs.org/files/sha256/dd/76/dd76183a799a7daaacfc632d3e723e9a7361661fb9aac4246da81e532eb3beeb
- FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/536BFC2BFEABC079862569AF006AAE73.0001
- DRS record last changed: November 21, 2025
- Page: https://openairdocs.org/ac/20-128

## Versions

- [AC 20-128A](https://openairdocs.org/ac/20-128) (Current), approved Mar 25, 1997, 45 pages
- [AC 20-128](https://openairdocs.org/ac/20-128?v=2190C5B7BCF102A786257E0400672592) (Historical), approved Mar 9, 1988, 6 pages

## Text

Each page's text from the PDF; open the PDF at a page with #page=N.

### Page 1

us.Deportmenl ot Tronsportotion Federal Aviation Admlnlslrallo.i Advisory Circular su1,Jed?ES1GN CONSIDERATIONS FOR Date: 3/25/97MINIMIZING HAZARDS CAUSED BY Initiated by: ANM-l lO

**UNCONT AINED TURBINE ENGINE AND**

**AUXILIARY POWER UNIT ROTOR**

**FAILURE**

1. PURPOSE. This advisory circular (AC) sets forth a method of compliance with the requirements of§§ 23.901(±), 23.903(b)(l), 25.901(d) and 25.903(d)(l) of the Federal Aviation Regulations (FAR) pertaining to design precautions taken to minimize the hazards to an airplane in the event of uncontained engine or auxiliary power unit (APU) rotor failures. The guidance provided within this AC is harmoni zed with that of the European Joint Aviation Authorities (JAA) and is intended to provide a method of compliance that has been found acceptable . As with all AC material, it is not mandatory and does not constitute a regulation.

2. CANCELLATION. Advisory Circular 20-128, "Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor and Fan Blade Failures," dated March 9, 1988, is canceled .

3. APPLICABILITY. This AC applies to part 23 and part 25 airplanes (and airplanes typecertificated under predecessor parts 3 and 4b of the Civil Air Regulations) for which a new, amended, or supplemental type certificate is<;,.;quested.

4. RELATED DOCUMENTS. Sections 23.903, and 25.903 of the FAR, as amended through Amendments 23-43 and 25-73 respectively, and other sections relating to uncontained engine failures .

NOTE: APPENDIX 1 provides additional guidance for completion of the nwnerical analysis requested in Paragraph 10 of this AC.

a. Related Federal Aviation Regulations. Sections which prescribe requirements for the design , substantiat ion and certification relating to uncontained engine debri s include:

§ 23.863, 25.863 Flammab le fluid fire protection § 25.365 Pressurized compartment loads § 25.571 Damage -tolerance and fatigue evaluation of structure FAA Form 1320-15 (4-82 ) Supersedes WA Form 132~2

### Page 2

3/25/97AC 20-128A § 25.963 Fuel tanks : general § 25.1189 Shutoff means § 25.1461 Equipment containing high energy rotors (Note: An APU does not have its own type certificate and has been considered "equipment " installed on an airplane. As such, the provisions of § 25.1461 have occasionally been used in the approval of APU installations regardless of protection from high energy rotor disintegration. However, the more specific requirements of§ 25.903(d)(l) and associated guidance described within this AC take precedence over the requirements of§ 25.1461.)

b. Advisory Circulars (AC).

AC 25-8 Auxiliary Fuel System Installations AC 25-20 Pressurization, Ventilation and Oxygen Systems Assessment for Subsonic Flight Including High Altitude Operations AC 23-10 Auxiliary Fuel System Installations AC 20-135 Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria ( or the equivalent International Standard Order (ISO) 2685) AC 25-571-lA Damage Tolerance and Fatigue Evaluat ion of Structure Advisory Circulars can be obtained from the U.S. Department of Transportation, M-443.2, Subsequent Distribution Unit, Washington, D.C. 20590.

c. Technical Standard Orders (TSO).

TSO C77a Gas Turbine Auxiliary Power Units (orJARAPU) 2 Par 4

### Page 3

Technical Standard Orders can be obtained from the Federal Aviation Administration (FAA), Aircraft Certification Service, Aircraft Enginee ring Division, Technical Analysis Branch (AIR­

120), 800 Independence Ave. S.W., Washington, DC, 205921.

d. Society of Automotive En~ineers (SAE) Documents.

AIR1537 Report on Aircraft Engine Containment, dated October, 1977.

AIR4003 Uncontained Turbine Rotor Events Data Period 1976 through 1983.

AIR4770 Uncontained Turbine Rotor Events Data Period 1984 (Draft) through 1989.

These documents can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096.

5. BACKGROUND. Although turbine engine and APU manufacturers are making efforts to reduce the probability of uncontained rotor failures, service experience shows that uncontained compressor and turbine rotor failures continue to occur. Turbine engine failures have resulted in high velocity fragment penetration of adjacent structures, fuel tanks, fuselage , system components and other engines on the airplane. While APU uncontained rotor failures do occur, and to date the impact damage to the airplane has been minimal, some rotor failures do produce fragments that should be considered . Since it is unlikely that uncontained rotor failures can be completely eliminated, parts 23 and 25 require that airplane design precauti ons be taken to minimize the hazard from such events.

a. Uncontained ~as turbine en~ine rotor failure statistics are presented in the Society of Automotive Engineers (SAE) reports covering time periods and number of uncontained events listed in the table shown below. The following statistics summarize 28 years of service experience for fixed wing airplanes and do not include data for rotorcraft and APU's:

NQ, Qf Ev~nts RegottNo, fe1fod Iotal Cate2oa 3 Cate~oa 4 AIR1537 AIR4003 AIR4770 (Draft) TOTAL 1962-75 1976-83 1984-89 275 237 164 676 44 27 22 93 5 3 7 15 Par 4 3

### Page 4

The total of 676 uncontained events includes 93 events classified in Category 3 and 15 events classified in Category 4 damage to the airplane . Category 3 damage is defined as significant airplane damage with the airplane capable of continuing flight and making a safe landing . Category 4 damage is defined as severe airplane damage involving a crash landing, critical injuries, fatalities or hull loss.

During this 28 year period there were 1,089.6 million engine operating hours on commercial transports. The events were caused by a wide variety of influences classed as environmental (bird ingestion, corrosion/erosion, foreign object damage (FOD)), manufacturing and material defect s, mechanical, and human factors (mainte nance and overhaul, inspection error and operational procedures).

b. Uncontained APU rotor failure statistics covering 1962 through 1993 indicate that there have been several uncontained failures in at least 250 million hours of operation on transport category airplanes. No Category 3 or 4 events were reported and all failures occurred during ground operation. These events were caused by a wide variety of influences such as corrosion, ingestion of deicing fluid, manufacturing and material defects, mechanical, and human factors (maintenance and overhaul, inspection error and operational procedures).

c. The statistics in the SAE studies indicate the existence of many different causes of failures not readily apparent or predictable by failure analysis methods. Because of the variety of causes of uncontained rotor failures, it is difficult to anticipate all possible causes of failure and to provide protection to all areas. However, design considerations outlined in this AC provide guidelines for achieving the desired objective of minimizing the hazard to an airplane from uncontained rotor failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects of this failure is necessary. These guidelines are based on service experience and tests but are not necessarily the only means available to the designer.

**6. DEFINITIONS.**

a. E.Q.tQr. Rotor mean s the rotating components of the engine and APU that analysis, test, and/or experience has shown can be released during uncontained failure. The engine or APU manufacturer shou ld define those components that constitute the rotor for each engine and APU type design . Typically rotors have included, as a minimum, disks, hubs, drums, seals, impellers , blades and spacers.

b. Blade. The airfoil sectio ns (excludin g platform and root) of the fan, compressor and turbine.

Par5 4

### Page 5

'3/25/97 AC 20-I28A

c. Uncontained Failure. For the purpose of airplane evaluations in accordance with this AC, uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments from the engine or APU that could result in a hazard. Rotor failures which are of concern are those where released fragments have sufficient energy to create a hazard to the airplane.

d. Critical Component. A critical component is any component whose failure would contribute to or cause a failure condition which would prevent the continued safe flight and landing of the airplane. These components should be considered on an individual basis and in relation to other components which could be damaged by the same fragment or by other fragments from the same uncontained event.

e. Continued Safe Flight and Landin2. Continued safe flight and landing means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures and without exceptional pilot skill or strength, with conditions of considerably increased flightcrew workload and degraded flight characteristics of the airplane.

f. Fra2ment Spread Angle. The fragment spread angle is the angle measured, fore and aft from the center of the plane of rotation of an individual rotor stage , initiating at the engine or APU shaft centerline (see Figure 1).

Par 6 5

### Page 6

AC 20-128A

**FANBLADE I**

FRAGMENTS ---I ~::"~/ ::--] \ \ I f \ ,I V"'l' \ I FIGURE 1- ESTIMATED PATH OF FRAGMENTS 6 3/25/97 1I3RDDlSK

FRAGMENT (sec figure3)

**INTERMEDIATE**

FRAGMENT (see figure4)

SMALL FRAGMENTS (sec paragraph 9(d»

FRAGMENT SPREAD ANGLE IS THE ANGLE MEASURED, fORE AND AFT, FROM THE CENn:R or THE PLANE or ROTATION

**INITIATING AT THE ENGINE OR APU SHAFT CENTERUNE.**

Par 6 ~

### Page 7

g. Impact Area. The impact area is that area of the airplane likely to be impacted by uncontained fragments generated during a rotor failure (see Paragraph 9).

h. Eniine and APU Failure Model. A model describing the size, mass, spread angle, energy level and number of engine or APU rotor fragments to be considered when analyzing the airplane design is presented in Paragraph 9.

7. DESIGN CONSIDERATIONS. Practical design precautions should be used to minimize the damage that can be caused by uncontained engine and APU rotor fragments . The most effective methods for minimizing the hazards from uncontained rotor fragments include location of critical components outside the fragment impact areas or separation, isolation, redundancy, and shielding of critical airplane components and/or systems. The following design considerations are recommended:

a. Consider the location of the eniiue and APU rotors relative to critical components, systems or areas of the airplane such as:

(1) Any other engine(s) or an APU that provides an essential function;

(2) Pressurized sections of the fuselage and other primary structure of the fuselage, wings and empennage;

(3) Pilot compartment areas;

(4) Fuel system components, piping and tanks ;

(5) Control systems , such as primary and secondary flight controls, electrical power cables, wiring, hydraulic systems, engine control systems, flammable fluid shut-off valves, and the associated actuation wiring or cables;

(6) Any fire extinguisher system of a cargo compartment, an APU, or another engine including electrical wiring and fire extinguishing agent plumbing to these systems;

(7) Engine air inlet attachments and effects of engine case deformations caused by fan blade debris resulting in attachment failures;

(8) Instrumentation essential for continued safe flight and landin g;

(9) Thrust rever ser systems where inadvertent deployment could be catastrophic ; and Par6 7

### Page 8

(10) Oxygen systems for high altitude airplanes , where these are critical due to descent time .

b. Location of Critical Systems and Components. Critical airplane flight and engine control cables, wiring , flammable fluid carrying components and lines (including vent lines), hydraulic fluid lines and components, and pneumatic ducts should be located to minimize hazards caused by uncontained rotors and fan blade debris. The following design practices should be considered :

(1) Locate, if possible, critical components or systems outside the likely debris impact areas.

(2) Duplicate and separate critical components or systems, or provide suitable protection if located in debris impact areas.

(3) Protection of critical systems and components can be provided by using airframe structure or supplemental shielding.

These methods have been effective in mitigating the hazards from both sing le and multiple small fragments within the± 15 degree impact area. Separation of multiplicated critical systems and components by at least a distance equal to the 1/2 blade fragment dimension has been accepted for showing minimization from a single high energy small fragment when at least one of the related multiplicated critical components is shielded by significant structure such as aluminum lower wing skins, pylons , aluminum skin of the cabin pressure vessel, or equivalent structures.

Multiplicated critical systems and components positioned behind less significant structures should be separated by at least a distance equal to the 1/2 blade fragment dimension, and at least one of the multiplicated critical systems should be:

(i) Located such that equivalent protection is provided by other inherent structures such as pneumatic ducting, interiors, bulkheads , stringers, or

(ii) Protected by an additional shield such that the airframe structure and shield material provide equivalent shielding.

(4) Locate fluid shutoffs and actuation means so that flammable fluid can be isolated in the event of damage to the system.

Par 7 8

### Page 9

(5) Minimize the flammable fluid spillage which could contact an igni tion source.

(6) For airframe structural elements, provide redundant designs or crack stoppers to limit the subsequent tearing which could be caused by uncontain ed rotor fragments.

(7) Locate fuel tanks and other flammable fluid systems and route lines (including vent lines) behind airplane structure to reduce the hazards from spilled fuel or from tank penetrations. Fuel tank explosion-suppression materials, protective shields or deflectors on the fluid lines , have been used to minimize the damage and hazards.

c. External Shields and Deflectors. When shields, defle ction devices or airplane structure are proposed to be used to protect critical systems or components, the adequacy of the protection, including mounting points to the airframe structure, should be shown by testing or validated analyse s supported by test data , using the fragment energie s supplied by the engine or APU manufacturer or those defined in Paragraph 9. For protection against engine small :fragments, as defined in Paragraph 9, no quantitative validation as defined in Paragraph 10 is required if equivalency to the penetrati on resistant structures listed (e.g. pressure cabin skins, etc.) is shown.

8. ACCEPTED DESIGN PRECAUTIONS. Design practices currently in use by the aviation industry that have been shown to reduce the overall risk, by effectively elimina ting certain specific risks and reducing the remaining specific risks to a minimum level, are described within this paragraph of the AC. Airplane designs submitted for evaluation by the regulato ry authorities will be evaluated against these proven design practice s.

a. Uncontrolled Fire.

( 1) Fire Extin~ishin~ Systems. The engine / APU fire extinguishing systems currently in use rely on a fire zone with a fixed compartment air volume and a known air exchange rate to extinguish a fire. The effectiveness of this type of system along with firewal l integrity may therefo re be compromised for the torn/ruptured compartm ent of the failed engine /APU . Protection of the airplane following this type of failure relie s on the funct ion of the fire warning system and subsequent fire switch activation to isolate the engine/APU from airframe flammable fluid (fuel and hydraulic fluid) and external igniti on sources (pneumatic and electrical). Fire extingui shing protection of such a compromised system may not be effective due to the extent of dama ge. Continued function of any other engine, APU or cargo compartm ent fire warning and extinguisher system, i ncludin g electrical wirin g and fire extinguishing agent plumbing, should be considered as describe d in Paragraph 7.

Par 7 9

### Page 10

(2) Flammable Fluid ShutoffValve. As discussed above, shutoff of flammable fluid supply to the engine may be the only effective means to extinguish a fire following an uncontained failure, therefore the engine isolation/flammable fluid shutoff function should be assured following an uncontained rotor failure. Flammable fluid shutoff valves should be located outside the uncontained rotor impact area. Shutoff actuation controls that need to be routed through the impact area should be redundant and appropriately separated in relation to the one-third disc maximum dimension.

(3) Fire Protection ofCritical Functions. Flammable fluid shutoff and other critical controls should be located so that a fire (caused by an uncontained rotor event) will not prevent actuation of the shutoff function or loss of critical airplane functions. If shutoff or other critical controls are located where a fire is possible following an uncontained rotor failure (e.g. in compartments adjacent to fuel tanks) then these items should meet the applicable foe protection guidelines such as AC 20-135, "Powerplant Installation and Propulsion System Component Fire Protection Test Methods, Standards, and Criteria" or the equivalent International Standard Order (ISO) 2685.

(4) Fuel Tanks. If fuel tanks are located in impact areas, the following precautions should be implemented:

(i) Protection from the effects of fuel leakage should be provided for any fuel tanks located above an engine or APU and within the one-third disc and intermediate fragment impact areas. Dry bays or shielding are acceptable means. The dry bay should be sized based on analysis of possible fragment trajectories through the fuel tank wall and the subsequent fuel leakage from the damaged fuel tank so that fuel will not migrate to an engine, APU or other ignition source during either in flight or ground operatio n. A minimum drip clearance distance of 10 inches from potential ignition sources of the engine nacelle, for static conditions, is acceptable (see Figure 2).

10 Par 8

### Page 11

3/25/97 AC20-128A

**MINIMUM , ,**

**PLAN VIEW A 2 /**

**INTEGRAL**

FUELTANK/ ~ '-~7~ ~LlADIl'fC EDCE 1• Lo••er WlDl SkiD PeaetnltioD

1. Fael Taakw.n Penetration \ \ ) ncnoNA-A et#===I • Mile Depends ODWine Skbllmpact Restslance (5 t.15DOlrees) SEcrIOf"f 8-.

ParS FIGURE 2- DRY BAY SIZING DETERMINATION EXAMPLE --- 11

### Page 12

AC20-l28A 3/25/97

(ii) Fueltankpenetration leakpaths shouldbedetermined and evaluated forhazardsduringflightandgroundphasesofoperation. Iffuelspillsintothe airstreamaway fromtheairplanenoadditionalprotection isneeded. Additional protection should beconsidered iffuelcouldspill,drainormigrateintoareashousing ignition sources,such asengineorAPU inletsorwheelwells. Damagetoadjacentsystems, wiringetc.,shouldbe evaluatedregardingthepotentialthatanuncontained fragmentwillcreatebothanignition source andfuelsource. Wheelbrakesmaybeconsideredasanignition sourceduringtakeoffandinitial climb. Protectionofthewheelwellsmaybeprovidedbyairflowdischarging fromgapsor openings,preventing entryoffuel,aventilationrateprecluding acombustible mixtureorother provisions indicatedin 23.863and25.863.

(iii) Areasoftheairplanewhereflammable fluidmigration ispossible thatarenotdrainedandventedandhaveignitionsourcesorpotential ignition sourcesshouldbe provided withameansoffiredetectionandsuppressionandbeexplosionvented orequivalently protected.

b. LossofThrust.

(I) FuelReserves Thefuelreservesshouldbeisolatable suchthatdamage fromadiscfragmentwillnotresultinlossoffuelrequiredtocompletetheflightorasafe diversion. Theeffectsoffuelloss,andtheresultantshiftofcenterofgravityorlateral imbalance onairplane controllability shouldalsobeconsidered.

(2) Encine Controls Enginecontrolcablesand/orwiring fortheremaining powerplants thatpassthroughtheimpactareashouldbeseparatedbyadistance equaltothe maximum dimension ofaone-thirddiscfragmentorthemaximum extentpossible.

(3) Other EncineDamace. Protectionofanyotherengines fromsome fragments shouldbeprovidedbylocatingcriticalcomponents, suchasengine accessories essential forpropercngineoperation (e.g.,highpressurefuellines,enginecontrols andwiring, etc.),inareaswhereinherentshieldingisprovidedbythefuselage,engine ornacelle(including thrustreverser)structure (seeParagraph7).

c. LossofAirplaneControl.

(I) F1icht Controls Elementsoftheflightcontrolsystemshould be adequately separatedorprotectedsothatthereleaseofasingleone-third discfragment willnot causelossofcontroloftheairplaneinanyaxis. Whereprimary flightcontrols haveduplicated (ormultiplicated) elements,theseelementsshouldbelocatedtoprevent allelements inanyaxis beinglostasaresultofthesingleone-thirddiscfragment. Creditformaintaining controlofthe 12 Par 8 ~~

### Page 13

airplane by the use of trim controls or other means may be obtained, providing evidence shows that these means will enable the pilot to retain control.

(2) Emergency Power. Loss of electrical power to critical functions following an uncontained rotor event should be minimized. The determination of electrical system criticality is dependent upon airplane operations. For example, airplanes approved for Extended Twin Engine Operations (ETOPS) that rely on alternate power sources such as hydraulic motor generators or APUs may be configured with the electrical wiring separated to the maximum extent possible within the one-third disc impact zone.

(3) Hydraulic Supply. Any essential hydraulic system supply that is routed within an impact area should have means to isolate the hydraulic supply required to maintain control of the airplane. The single one-third disc should not result in loss of all essential hydraulic systems or loss of all flight controls in any axis of the airplane.

(4) Thrust reverser systems. The effect of an unconta ined rotor failure on inadvertent in-flight deployment of each thrust reverser and possible loss of airplane control shall be considered. The impact area for components located on the failed engine may be different from the impact area defined in Paragraph 6. Ifuncontained failure could cause thrust reverser deployment, the engine manufacturer should be consulted to establish the failure model to be considered. One acceptable method of minimization is to locate reverser restraints such that not all restraints can be made ineffective by the fragments of a single rotor.

d. Passenger and Crew Incapacitation.

(1) Pilot Compartment. The pilot compartment of transport category airplanes should not be located within the ±15 degree spread angle of any engine rotor stage or APU rotor stage that has not been qualified as contained, unless adequate shielding, deflectors or equivalent protection is provided for the rotor stage in accordance with Paragraph 7 c. Due to design constraints inherent in smaller Par 25 airplanes it is not considered practical to locate the pilot compartment outside the ±15 degree spread angle. Therefore , for other airplanes (such as new part 23 commuter category airplanes) the pilot compartment area should not be located within the ±5 degree spread angle of any engine rotor stage or APU rotor stage unless adequate shielding, deflectors, or equivalent protection is provided for the rotor stage in accordance with Paragraph 7 c of this AC, except for the following :

(i) For derivative part 23 category airplanes where the engine location has been previously established, the engine location in relation to the pilot compartment need not be changed. · Par8 13

### Page 14

AC 20-128A 3/ 25/97

(ii) For noncommuter part 23 category airplanes, satisfactory service experience relative to rotor integrity and containment in similar engine installations may be considered in assessing the acceptability of installing engines in line with the pilot compartment.

(iii) For noncommuter new part 23 category airplanes , where due to size and/or design considerations the ±5 degree spread angle cannot be adhered to, the pilot compartment/engine location should be analyzed and accepted in accordance with Paragraphs 9 and 10.

(2) Pressure Vessel. For airplanes that are certificated for operati on above 41,000 feet, the engines should be located such that the pressure cabin cannot be affected by uncontained debris. Alternati vely, it may be shown that rapid decompression due to the maximum hole size caused by debris and the associated cabin pressure decay rate will allow an emergenc y descent without incapacitation of the flightcrew or passengers . A pilot reaction time of 17 seconds for initiation of the emergency decent has been accepted . Where the pressure cabin could be affected by a one-third disc or intermediate fragments , design precautions should be taken to preclude incapacitation of crew and passengers . Examples of design precautions that have been previously accepted are:

(i) Provisions for a second pressure or bleed down bulkhead outside the impact area of a one-third or intermediate disc fragment.

(ii) The affected compartment in between the primary and secondary bulkhead was made inaccessible, by operating limitations, above the minimum altitude where incapacitation could occur due to the above hole size.

(iii) Air supply ducts running through this compartment were provided with nonretum valves to prevent pressure cabin leakage through damaged ducts .

NOTE : If a bleed down bulkhead is used it should be shown that the rate of pressure decay and minimum achieved cabin pressure would not incapacitate the crew, and the rate of pressure decay would not preclude a safe emergency descent . Further guidance regarding compliance with the high altitude operations requirements is provided in AC 25-20 , "Pressurization, Ventilation and Oxygen Systems Assessment for Subsonic Flight Including High Altitude Operations ."

e. Structural Integrity . Installation of tear strap s and shear ties within the uncontained fan blade and engine rotor debris zone to prevent catastrophic structural damage has been utilized to addre ss this threat.

9. ENGINE AND APU FAILURE MODEL. The safety analysis recommended in Paragraph 10 should be made using the following engine and APU failure model, unless for the particular 14 Par 8

### Page 15

engine/ APU type concerned, relevant service experience , design data , test results or other evidence justify the use of a different model.

a. Single One-Third Disc fragment. It should be assumed that the one-third disc fragment has the maximum dimension corresponding to one-third of the disc with one-third blade height and a fragment spread angle of ± 3 degrees . Where energy considerations are relevant , the mass should be assumed to be one-third of the bladed disc mass and its energy , the translational energy (i.e., neglecting rotational energy) of the sector traveling at the speed ofits e.g. location as defined in Figure 3.

b. Intermediate Fragment . It should be assumed that the intermediate fragment has a maximum dimension corresponding to one-third of the bladed disc radius and a fragment spread angle of ± 5 degrees . Where energy considerations are relevant , the mass should be assumed to be 1/30 of the bladed disc mass and its energy the transitional energy (neglecting rotat ional energy) of the piece traveling at rim speed (see Figure 4).

Par 9 15

### Page 16

AC 20-128A 16 Where R = disc radius b = blade length The CG is taken 10 lie on !he mAX1mum dimension as shown .

**FIGURE 3 - SINGLE ONE-TIIIRD ROTOR FRAGMENT I I / / / / ,.,------.............**

Where R ,. disc radius b = blade length Maximum dimension = ½ (R + b) Mass assumed 10 be 1/.Jalh at bladac:I disc CG is taken 10 fie on the disc rim ' ' FIGURE 4- INTERMEDIATE FRAGMENT ' ' \ \ \ \ b '-I 3/25/97 Par 9 =

=

= = -

### Page 17

c. AlternativeEngineFailureModel. Forthepurpose ofthe analysis,asan alternativetothe enginefailuremodelof Paragraphs 9aandb,theuseofasingleone-third piece ofdischavingafragment spreadangle 5°wouldbeacceptable,providedthe objectivesof Paragraph lOaaresatisfied.

d. SmallFragments. Itshouldbeassumedthat smallfragments(shrapnel)rangein sizeupto amaximumdimensioncorresponding tothetiphalfofthebladeairfoil(withexception offanblades) andafragment spreadangleof ISdegrees. Servicehistoryhasshownthat aluminumlowerwingskins,pylons,andpressure cabinskinandequivalent structures typically resistpenetration fromallbutoneofthemost energeticofthesefragments. Theeffectsof multiplesmallfragmentsshouldalsobeconsidered. Penetration ofless significantstructures such asfairings,empennage,control surfacesandunpressurized skinhastypicallyoccurred attherate of2 112percent ofthe numberofbladesofthefailedrotor stage. Refertoparagraph 7band7c formethodsofminimizationofthehazards. Wheretheapplicantwishesto showcomplianceby consideringtheenergyrequired forpenetration ofstructure (orshielding)theenginemanufacturer shouldbeconsultedforguidanceastothe sizeandenergyofsmallfragmentswithintheimpact area.

For APUs,where energyconsiderations arerelevant,itshouldbeassumedthatthemass willcorrespond tothe abovefragmentdimensionsandthatithasatranslational energylevelof onepercent ofthetotal rotational energyofthe originalrotor stage.

e. FanBladeFragment. Itshouldbeassumedthatthefanbladefragmenthasa maximumdimensioncorresponding tothebladetipwithone-third thebladeairfoilheightanda fragment spreadangleof~ 15°. Where energyconsiderations arerelevantthemassshouldbe assumedtobecorresponding totheone-thirdoftheairfoilincludinganypart spanshroudandthe transitional energy(neglectingrotational energy)ofthefragmenttravelingatthe speedofitsC.g.

location asdefinedinFigure5. Asanalternative,theenginemanufacturer maybeconsultedfor guidance astothe sizeandenergyofthefragment.

Par 9 17 ~ ~

### Page 18

Geometric Center of Gravity T 113X Where X Airfoil Length (less bbde root & platform) CG is taken to lieatthe centerline of the 113 fragment Fragment velocity taken at geometric CG Fragment mass assumed to be 113nf the airfoil mass 18 FIGURE 5 FAN BLADE FRAGMENT DEFINITION Par 9 - -

### Page 19

f. Critical Engine Speed . Where energy considerations are relevant , the uncontained rotor event should be assumed to occur at the engine or APU shaft red line speed.

g. APU Failure Model. For all APU's, the installer also needs to address any hazard to the airplane associated with APU debris (up to and including a complete rotor where applicable) exiting the tailpipe . Paragraphs 9g(l) or (2) below or applicable service history provided by the APU manufacturer may be used to define the size, mass , and energy of debris exiting that tailpipe . The APU rotor failure model applicable for a particular APU installation is dependent upon the provisions of the Technical Standard Orders (TSO) that were utilized for receiving approval:

(1) For APU's where rotor integrity has been demonstrated in accordance with TSO C77a/JAR APU , i.e. without specific containment testing, Paragraphs 9a, b, and d, or Paragraphs 9c and 9d apply.

(2) For APU rotor stages qualified as contained in accordance with the TSO, historical data shows that in-service uncontained failures have occurred. These failure modes have included bi-hub, overspeed, and fragments missing the containment ring which are not addressed by the TSO containment test. In order to address these hazards , the installer should use the APU small fragment definition ofParagraph 9d or substantiated in-service data supplied by the APU manufacturer .

10. SAFETY ANALYSIS The numerical assessment requested in paragraph 10 (c)(3) is derived from methods previously prescribed in ACJ 25. 903 . The hazard ratios provided are based upon evaluation of various configurations of transport category airplanes , made over a period of time, incorporating practical methods of minimizing the hazard to the airplane from uncontained engine debris.

a. Analysis . An analysis should be made using the engine/ APU model defined in Paragraph 9 to determine the critical areas of the airplane likely to be damaged by rotor debri s and to evaluate the consequences of an uncontained failure . This analysis should be conducted in relation to all normal phases of flight, or portions thereof.

(1) A delay of at least 15 seconds should be assumed before start of the emergency engine shut down . The extent of the delay is dependent upon circumstances resulting from the uncontained failure including increased flightcrew workload stemming from multiplicit y of warnings which require analysis by the flightcrew .

(2) Some degradation of the flight characteristics of the airplane or operation of a system is permissible , provided the airplane is capable of continued safe flight and landing .

Par 9 19

### Page 20

AC20-128A 3/25/97 Account shouldbetakenofthebehaviorofthe'airplaneunderasymmetricalenginethrust or powerconditionstogether withanypossibledamagetotheflightcontrol system,andofthe predicted airplanerecoverymaneuver.

(3) Whenconsideringhoworwhethertomitigateanypotentialhazard identifiedbythemodel,creditmaybegiventoflightphase,serviceexperience,orotherdata,as notedinParagraph7.

b. Drawings. Drawingsshouldbeprovidedtodefinetheuncontained rotor impact threatrelativetotheareasofdesignconsiderationdefinedinParagraphs 7a(l) through (10) showingthetrajectory pathsofengineandAPUdebrisrelativetocriticalareas. Theanalysis shouldincludeatleastthefollowing:

(1) Damage to pnmary structure including the pressure cabin, engine!APU mountingsandairframesurfaces.

NOTE: Any structural damage resulting from uncontained rotor debris should be considered catastrophic unlessthe residualstrength andfluttercriteriaofAC25.571, Paragraph 8(c),canbe metwithout failureofanypart ofthe structure essentialforcompletion ofthe flight. In addition, thepressurized compartmentloadsof 25.365(e)(I) and(g)mustbemet.

(2) Damageto anyotherengines(theconsequencesofsubsequentuncontained debrisfromtheother engine(s),neednotbeconsidered).

(3) Damageto servicesandequipmentessentialforsafeflightandlanding (includingindicatingandmonitoringsystems),particularlycontrolsystemsforflight,engine power, enginefuelsupplyandshut-offmeansandfireindicationandextinguishingsystems.

(4) Pilotincapacitance,(seealsoparagraph 8d(I»).

(5) Penetration ofthefuelsystem,wherethiscouldresultinthereleaseoffuel intopersonnelcompartments or anenginecompartmentorotherregionsoftheairplanewhere thiscouldleadto afireorexplosion.

(6) Damagetothefuelsystem,especiallytanks,resultinginthereleaseofa largequantityoffuel.

(7) Penetration anddistortionoffirewallsandcowlingpermittingaspreadof fire.

20 Par 10 ~

### Page 21

(8) Damageto orinadvertentmovementofaerodynamicsurfaces(e.g..flaps, slats,stabilizers,ailerons,spoilers,thrust reversers,elevators, rudders, strakes, winglets, etc.) and theresultant effectonsafeflightandlanding.

c. SafetyAnalysisObjectives Itisconsideredthatthe objectiveofminimizing hazardswillhavebeenmetif:

(I) havebeentaken;

Thepracticaldesignconsiderations andprecautions ofParagraphs 7and8

(2) The safetyanalysishasbeencompletedusingthe engine/APU model definedinParagraph 9; .

(3) For part 25transport andpart 23commuter category airplanes,the followinghazard ratioguidelineshavebeenachieved:

(i) SingleOne-ThirdDiscFragment. There isnotmorethana I in20 chanceofcatastrophe resultingfromthereleaseofasingleone-thirddiscfragment asdefinedin Paragraph 9a.

(ii) Intermediate Fragment. Thereisnotmorethana Iin40chanceof catastrophe resultingfromthereleaseofapieceofdebrisasdefinedinParagraph 9.

(iii) MultipleDiscFragments. (Onlyapplicableto anyduplicatedor multiplicatedsystemwhenallofthe systemchannelscontributingto itsfunctionshavesomepart whichiswithinadistanceequaltothediameterofthelargestbladedrotor, measured fromthe enginecenterline). Thereisnotmorethan Iin10chanceofcatastrophe resultingfromthe releaseinthree random directions of threeone-thirdfragmentsofadisceachhavingauniform probabilityofejectionoverthe 3600 (assuminganangularspreadof 01030relativetothe planeof the disc)causingcoincidentaldamageto systemswhichareduplicated ormultiplicated.

NOTE: Where dissimilarsystemscanbeusedto carryoutthesamefunction(e.g. elevator control andpitchtrim),theyshouldberegarded asduplicated(ormultiplicated)systemsforthe purpose ofthissubparagraph provided controlcanbemaintained. The numericalassessments describedabovemaybeusedtojudge therelativevaluesofminimization. Thedegree of minimizationthatisfeasiblemayvarydependingupon airplanesizeandconfiguration andthis variationmaypreventthe specifichazardratiofrombeingachieved. Theselevelsaredesigngoals andshouldnotbetreated asabsolutetargets. Itispossiblethat anyone oftheselevelsmaynot bepracticalto achieve.

Par 10 21

### Page 22

(4) For newly designed non-commuter part 23 airplanes the chance of catastrophe is not more than twice that of Paragraph IDc(3)(i), (ii) and (iii) for each of these fragment types.

(5) A numerical risk assessment is not requested for the single fan blade fragment, small fragments, and APU and engine rotor stages which are qualified as contained.

d. APU Analysis For APU's that are located where no hazardous consequences would result from an uncontained failure, a limited qualitative assessment showing the relative location of critical systems/components and APU impact areas is all that is needed. If critical systems/components are located within the impact area, more extensive analysis is needed. For APU's which have demonstrated rotor integrity only, the failure model outlined in Paragraph 9g(l) should be considered as a basis for this safety assessment. For APU rotor stages qualified as contained per the TSO, the airplane safety analysis may be limited to an assessment of the effects ofthe failure model outlined in Paragraph 9g(2).

e. Specific Risk The airplane risk levels specified in Paragraph I Dc, resulting from the release of rotor fragments, are the mean values obtained by averaging those for all rotor on all engines of the airplane, assuming a typical flight. Individual rotors or engines need not meet these risk levels nor need these risk levels be met for each phase of flight if either-- (I) No rotor stage shows a higher level of risk averaged throughout the flight greater than twice those stated in Paragraph I Dc.

NOTE: The purpose of this Paragraph is to ensure that a fault which results in repeated failures of any particular rotor stage design, would have only a limited effect on airplane safety.

22 Par 10

### Page 23

•Average ofUK and US Data (1966-76)

• SA[ data for the period 1962 to 1989 ,howl. similar distributioD.

LandlngtReyerseDescent 2 cum.Take-orrbeforeVi Vi tonrstPower ReducOon o 3535 30 25 /!!z 20 U

•• 15 0 10 5

PHASE OF FUGHT FIGURE 6 ALL NON-CONT AINMENTS BYPHASE OF FLIGHT Par 10 23 ~ ~ ~ -

### Page 24

AC 20-l28A .3/25/97

(2) Where failures would be catastrophic inparticular portions of flight, allowance ismade for this on the basis of conservative assumptions as to the proportion of failures likely to occur inthese phases. A greater level of risk could be accepted ifthe exposure exists only during aparticular phase of flight e.g., during takeoff. The proportional risk of engine failure during the particular phases of flight is given in SAE Papers referenced in Paragraph 4d. See also data contained inthe CAA paper "Engine Non-Containments The CAA View", which includes Figure 6. This paper ispublished inNASA Report CP-20l7, "An Assessment of Technology for Turbo-jet Engine Rotor Failures", dated August 1977.

K. McGrath ager, Aircraft Engineering ivision, AIR-IOO 24 Par 10 -

### Page 25

3/25/97

1.0

2.0

3.0

4.0

5.0

6.0

7.0 FIGURE 1 FIGURE 2 FIGURE 3 FIGURE 4 FIGURE 5 FIGURE 6 FIGURE 7 FIGURE 8 AC 20-128A Appendix 1 APPENDIX 1 AC-20-128A USER'S MANUAL

RISK ANALYSIS METHODOLOGY for UNCONTAINED ENGINE/APU FAILURE INDEX

**GENERAL SCOPE**

**FUNDAMENTAL COMPONENTS OF A SAFETY AND RISK ANALYSIS**

**ASSUMPTIONS**

**PLOTTING**

**METHODOLOGY PROBABILITY ASSESSMENT**

**RESULTS ASSESSMENT**

**EXAMPLE HAZARD TREE**

**EXAMPLE SYSTEM LOADING MATRIX**

**TRI-SECTOR ROTOR BURST**

**TYPICAL LAYOUT OF SYSTEMS IN ROTOR PLANE**

**TRAJECTORY RANGE PLOTTING**

**TYPICAL TRAJECTORY PLOTTING**

**DEFINITION THREAT WINDOW**

**SAMPLE ROTOR STAGE PLOTTING CHART - - - -**

### Page 26

AC 20-128A Appendix 1

1.0

1.1

1.2

1.3

1.4

1.5

1.6 2 3/25/97

GENERAL The design of airplane and engine systems and the location of the engines relative to critical systems and structure have a significant impact on survivability of the airplane following an uncontained engine failure.

Sections 23.903(b)(1) and 25.903(d)(1) of the Federal Aviation Regulations (FAR) require that design precautions be taken to minimize the hazard to the airplane due to uncontained failures of engine or auxiliary power unit (APU).

Advisory Circular 20-128A provides guidance for demonstrating compliance with these requirements.

As a part of this compliance demonstration, it is necessary to quantitatively assess the risk of a catastrophic failure in the event of an uncontained engine failure. This User's Manual describes an acceptable method for this purpose.

The objective of the risk analysis is to measure the remaining risk after prudent and practical design considerations have been taken.

Since each airplane would have unique features which must be considered when applying the methods described in this manual, there should be some flexibility in the methods and procedures.

It is a preferred approach to use these methods throughout the development of-an airplane design to identify problem areas at an early stage when appropriate design changes are least disruptive. It is also advisable to involve the Federal Aviation Administration (FAA) in this process at an early stage when appropriate interpretation of the methodology and documentation requirements can be established.

It should be noted that although the risk analysis produces quantitative results, subjective assessments are inherent in the methods of the analysis regarding the criticality of specific types of airplane component failures.

Assumptions for such assessments should be documented along with the numerical results.

Airplane manufacturers have each developed their own method of assessing the effects of rotor failure; as there are many ways to get to the same result.

This User's Manual identifies all the elements that should be contained in an analysis so that it can be interpreted by a person not familiar with such a process.

### Page 27

3/25/97

1.7

1.8

1.9

1.10

1.11

1.12 AC 20-128A Appendix 1 The intent of this manual therefore is to aid in establishing how an analysis is prepared, without precluding any technological advances or existing proprietary processes or programs.

Advisory Circular 20-128A makes allowance for the broad configuration of the airplane: as such damage to the structure due to rotor failure generally allows for little flexibility in design. System lay-out within a rotor burst zone, however, can be optimized.

Damage to structure, which may involve stress analysis, generally can be analyzed separately, and later coordinated with simultaneous system effects.

For an analysis of the effects on systems due to a rotor failure the airplane must be evaluated as a whole; and a risk analysis must specifically highlight all critical cases identified which have any potential to result in a catastrophe.

Such an analysis can then be used to establish that reasonable precautions have been taken to minimize the hazards, and that the remaining hazards are an acceptable risk.

A safety and a risk analysis are interdependent, as the risk analysis must be based on the safety analysis.

The safety analysis therefore is the starting point that identifies potential hazardous or catastrophic effects from a rotor failure, and is the basic tool to minimize the hazard in accordance with the guidelines of AC 20-128A.

1.13 The risk analysis subsequently assesses and quantifies the residual risk to the airplane.

2.0 SCOPE The following describes the scope of analyses required to assess the airplane risk levels against the criteria set forth in Paragraph 10 of AC 20-128A.

### Page 28

Appendix 1

2.1 Safely Analysis is required to identify the critical hazards that may be numerically analyzed (hazards remaining after all practical design precautions have been taken).

Functional criticality will vary by airplane and may vary by flight phase.

Thorough understanding of each airplane structure and system functions is required to establish the criticality relative to each fragment trajectory path of the theoretical failure model.

Assistance from experts within each discipline is typically required to assure accuracy of the analysis in such areas as effects of fuel tank penetration on leakage paths and ignition hazards, thrust level control (for loss of thrust assessment), structural capabilities (for fuselage impact assessment), airplane controllability (for control cables impact assessment), and fuel asymmetry.

2.2 For each remaining critical hazard, the following assessments may be prepared using the engine/APU failure models as defined in Paragraph g of AC 20-128A:

(a) Flight mean risk for single 1/3 disk fragment.

(b) Flight mean risk for single intermediate fragment.

(c) Flight mean risk for alternate model (when used as an alternate to the 1/3 disk fragment and intermediate fragment).

(d) Multiple 1/3 disk fragments for duplicated or multiplicated systems.

(e) Specific risk for single 1/3 disk fragment and single intermediate fragment.

(f) Specific risk for any single disk fragment that may result in catastrophic structural damage.

4 ~

### Page 29

Appendix 1 The risk level criteria for each failure model are defined in Paragraph 10 of AC 20-128A.

**3.0 FUNDAMENTAL COMPONENTS OF A SAFETY AND RISK ANALYSIS**

3.1 The logical steps for a complete analysis are:

(a) Establish at the design definition the functional hazards that can arise from the combined or concurrent failures of individual systems, including multiplicated systems and critical structure.

(b) Establish a Functional Hazard Tree (see Figure 1), or a System Matrix (see Figure 2) that identifies all system interdependencies and failure combinations that must be avoided (if possible) when locating equipment in the rotor burst impact area.

In theory, if this is carried out to the maximum, no critical system hazards other than opposite engine or fuel line hits would exist.

(c) Establish the fragment trajectories and trajectory ranges both for translational and spread risk angles for each damage. Plot these on a chart or graph, and identify the trajectory ranges that could result in hazardous combinations (threats) as per the above system matrix or functional hazard analysis.

(d) Apply risk factors, such as phase of flight or other, to these threats, and calculate the risk for each threat for each rotor stage.

(e) Tabulate, summarize and average all cases.

3.2 In accordance with AC 20-128A the risk to the airplane due to uncontained rotor failure is assessed to the effects, once such a failure has occurred.

The probability of occurrence of rotor failure, as analyzed with the probability methods of AC 23.1309 and AC 25.1309-1a (i.e. probability as a function of critical uncontained rotor failure rate and exposure time), does not apply.

3.3 The total risk level to the airplane, as identified by the risk analysis, is the mean value obtained by averaging the values of all rotor stages of all engines of the airplane, expressed as Flight Mean Risk.

### Page 30

AC 20-128A Appendix 1

4.0

4.1 6 3/25/97

ASSUMPTIONS The following conservative assumptions, inaddition to those in Paragraphs 10(a) (1),(2)and (3)ofAC 20-128A, have been made insome previous analyses. However, each airplane design may have unique characteristics and therefore a unique basisfor the safety assessment leading to the possibility ofdifferent assumptions. All assumptions should be substantiated within the analysis:

(a) The 1/3diskfragment as modeled inparagraph 9(a) ofAC 20-128A travels along atrajectory paththat istangential tothe sector centroid locus, inthe direction of rotor rotation (Refer to Figure 3).

The sector fragment rotates about itscentroid without tumbling and sweeps a pathequal totwice the greatest radius that can be struck from the sector centroid that intersects itsperiphery.

The fragment isconsidered to possess infinite energy, and therefore to becapable ofsevering lines,wiring, cables and unprotected structure initspath, and to be undeflected from itsoriginal trajectory unless deflection shields arefitted. However, protective shielding or an engine being impacted maybe assumed to have sufficient massto stop even the most energetic fragment.

(b) The probability of release ofdebris within the maximum spread angle is uniformly distributed over alldirections.

(c) The effects ofsevered electrical wiring are dependent onthe configuration ofthe affected system. Ingeneral, severed wiring is assumed to not receive inadvertent positive voltage for any significant duration.

(d) Control cables that arestruck byafragment disconnect.

(e) Hydraulically actuated, cable driven control surfaces, which do not have designated "failto" settings, tend tofail to nullwhen control cables are severed. Subsequent surface float isprogressive and predictable.

(I) Systems components are considered unserviceable iftheir envelope has been touched. Incase ofanengine being impacted, the nacelle structure may be regarded as engine envelope, unless damage is not likelyto be hazardous.

### Page 31

Appendix 1

(g) Uncontained events involving in-flight penetration of fuel tanks will not result in fuel tank explosion.

(h) Unpowered flight and off-airport landings, including ditching, may be assumed to be not catastrophic to the extent validated by accident statistics or other accepted factors.

(i) Damage to structure essential for completion of flight is catastrophic (Ref. AC 20-128A, Paragraph 1O.b(1)).

(j) The flight begins when engine power is advanced for takeoff and ends after landing when tuming off the runway.

**5.0 PLOTTING**

5.1 Cross-section and plan view layouts of the airplane systems in the ranges of the rotor burst impact areas should be prepared, either as drawings, or as computer models.

These layouts should plot the precise location of the critical system components, including fuel and hydraulic lines, flight control cables, electric wiring harnesses and junction boxes, pneumatic and environmental system ducting, fire extinguishing components; critical structure, etc.

5.2 For every rotor stage a plane is developed. Each of these planes contains a view of all the system components respective outer envelopes, which is then used to generate a cross-section. See Figure 4.

5.3 Models or drawings representing the various engine rotor stages and their fore and aft deviation are then generated.

5.4 The various trajectory paths generated for each engine rotor stage are then superimposed on the cross-section layouts of the station planes that are in the range of that potential rotor burst in order to study the effects (see Figure 5).

Thus separate plots are generated for each engine rotor stage or rotor group.

To reduce the amount of an analysis the engine rotor stages may also be considered as groups, as applicable for the engine type, using the largest rotor stage diameter of the group.

### Page 32

Appendix 1

5.5 These trajectory paths may be generated as follows and as shown in Figure 6:

(a) Two tangent lines T1 are drawn between the locus of the centroid and the target envelope.

(b) At the tangent line touch points, lines N1 and N2 normal to the tangent lines, are drawn with the length equal to the radius of the fragment swept path (as also shown in Figure 1).

(c) Tangent lines T2 are drawn between the terminal point of the normal lines and the locus of the centroid. The angle between these two tangent lines is the translational risk angle.

5.6 The entry and exit angles are then calculated.

5.7 The initial angle of intersection and the final angle of intersection are recorded, and the trajectories in between are considered to be the range of trajectories in which this particular part would be impacted by a rotor sector, and destroyed (i.e. the impact area).

5.8 The intersections thus recorded are then entered on charts in tabular form so that the simultaneous effects can be studied. Refer to Figure 8.

Thus it will be seen that the total systems' effects can be determined and the worst cases identified.

5.9 Ifa potentially serious multiple system damage case is identified, then a more detailed analysis of the trajectory range will be carried out by breaking the failure case down into the specific fore-aft spread angle, using the individual rotor stage width instead of combined groups, if applicable.

**6.0 METHODOLOGY PROBABILITY ASSESSMENT**

6.1 Those rotor burst cases that have some potential of causing a catastrophe are evaluated in the analysis in an attempt to quantify an actual probability of a catastrophe, which will, in all cases, depend on the following factors:

(a) The location of the engine that is the origin of the fragment, and its direction of rotation.

g -

### Page 33

Appendix 1

(b) The location of critical systems and critical structure.

(c) The rotor stage and the fragment model.

(d) The translational trajectory of the rotor fragment,

(e) The specific spread angle range of the fragment.

(f) The specific phase of the flight at which the failure occurs.

(g) The specific risk factor associated with any particular loss of function.

6.2 Engine Location The analysis should address the effects on systems during one flight after a single rotor burst has occurred, with a probability of 1.0. As the cause may be anyone of the engines, the risk from each engine is later averaged for the number of engines.

The analysis trajectory charts will then clearly show that certain system damage is unique to rotor fragments from a particular engine due to the direction of rotation, or, that for similar system damage the trajectory range varies considerably between engines.

A risk summary should table each engine case separately with the engine location included.

6.3 Rotor Element The probability of rotor failure is assumed to be 1.0 for each of all rotor stages.

For the analysis the individual risk(s) from each rotor stage of the engine should be assessed and tabled.

6.4 Translational Risk Angle The number of degrees of included arc (out of 360) at which a fragment intersects the component/structure being analyzed. Refer to Figure 6 and Figure 7.

### Page 34

Appendix 1

6.5 Trajectory Probability (pl The probability of a liberated rotor fragment leaving the engine case is equal over 360°, thus the probability P of that fragment hitting a system component is the identified Translational Risk Angle <I:> in degrees0, divided by 360, i.e.

P = <1:>/360 or, <1:>1<1:>2 360

6.6 Spread Angle Ifthe failure model of the analysis assumes a (fore and aft) spread angle of:t 5°, then the spread angle is a total of 10°. Ifa critical component can only be hit at a limited position within that spread, then the exposure of that critical component can then be factored according to the longitudinal position within the spread angle, e.g.:

w2 W1 spread angle If a component can only be hit at the extreme forward range of +4° to +5°, then the factor is .1 (for one degree out of 10).

6.7 Threat Wjndow The definition of a typical threat window is shown in Figure 7.

6.8 Phase of Flight Certain types of system damage may be catastrophic only during a specific portion of the flight profile, such as a strike on the opposite engine during take-off after V1 (i.e. a probability of 1.0), while with altitude a straight-ahead landing may be possible under certain favorable conditions (e.g. a probability of less than 1.0). The specific case can then be factored accordingly.

lO - -

### Page 35

Appendix 1

6.8.1 The most likely time for an uncontained rotor failure to occur is during take-off, when the engine is under highest stress. Using the industry accepted standards for the percentage of engine failures occurring within each flight phase, the following probabilities are assumed:

Take-off before V1 35% V1 to first power reduction 20% Climb 22% Cruise 14% Descent 3% Approach 2% Landing/Reverse 4%

6.8.2 The flight phase failure distribution above is used in the calculations of catastrophic risk for all cases where this risk varies with flight phase.

Dp Pflight phase % 100

6.9 Other Risk Factors Risks such as fire, loss of pressurization, etc., are individually assessed for each case where applicable, using conservative engineering judgment. This may lead to a probability of catastrophe (i.e.. risk factor) smaller than 1.0.

6.9.1 The above probabilities and factors are used in conjunction with the critical trajectory range defined to produce a probability of the specific event occurring from any random rotor burst.

This value is then factored by the "risk" factor assessed for the case. to derive a calculated probability of catastrophe for each specific case.

Typical conditional probability values for total loss of thrust causing catastrophic consequences are:

11 =

### Page 36

AC 20-128A Appendix 1 Phase T.O.-V1 to first power reduction Climb Cruise Descent Approach

0.20

0.22

0.14

0.03

0.02

1.0

0.4

0.2

0.4

0.4 3/25/97 For each stage case apply all risk factors, and, if applicable, factor for Flight Phase-Failure distribution

6.10 All individual case probabilities are then tabled and summarized.

6.11 The flight mean values are obtained by averaging those for all disks or rotor stages on all engines across a nominal flight profile.

The following process may be used to calculate the flight mean value for each Failure Model:

(a) Establish from the table in Figure 8 the threat windows where, due to combination of individual damages, a catastrophic risk exists.

(b) For each stage case calculate the risk for all Critical Hazards

(c)

(d) For each engine, average all stages over the total number of engine stages

(e) For each airplane, average all engines over the number of engines.

**7.0 RESULTS ASSESSMENT**

7.1 An applicant may show compliance with 99 23.903(b)(1) and 25.903(d)(1) of the FAR using guidelines set forth in AC 20-128A. The criteria contained in AC 20-128A may be used to show that:

(a) Practical design precautions have been taken to minimize the damage.

that can be caused by uncontained engine debris, and .

(b) Acceptable risk levels, as specified in AC 20-128A, Paragraph 10, have been achieved for each critical Failure Model.

12 ~

### Page 37

3/25/97

7.2 AC 20-128A Appendix 1 The summary of the applicable risk level criteria is shown in Table 1 below.

Table 1 Summary of Acceptable Risk Level Criteria

7.3 Requirement Criteria Average 1/3 Disk Fragment 1 in 20 Average Intermediate Fragment 1in40 Average Alternate Model 1in 20@o!: 5' Spread Angle Multiple Disk Fragments 1in 10 Any single fragment 2 x corresponding average criterion (except for structural damage) Section 25.571 (e) of the FAR requires the structure to meet damage tolerance requirement for likely structural damage caused by an uncontained engine failure. Guidance for demonstrating compliance to this section is currently the subject of an ARAC harmonization effort and will be issued at a later date.

### Page 38

AC 20-128A Appendix 1

**ANALYSIS OF HAZARD 3/25/97**

**INTER-ENGINE DAMAGE TO**

**DAMAGE CONTROLS**

**HYDRAULICS NOSE STEER**

**MAIN BRAKES 14 AGURE 1 EXAMPLE. HAZARD TREE**

### Page 39

-3/25/97 ILOC iCOMPONENT iDAMAGE TO ISYSTEM LOADED iDETAIL AC 20-128A Appendix 1 I LEFT AILERON CABLESISURFACE HYDRAUUC POWER 1f1&13 RIGHT AILERON CABLESISURFACE HYDRAUUC POWER #2&13 LEFT SPOIlER OUTBD CDNTROLJSURFACE HYDRAUUC POWER 1f1

MULTI-FUNCTION RIGHT SPOIlER. OUTBD CONTROLJSURFACE HYDRAUUC POWER 1f1

MULTI-FUNCTION LEFT FU\P.OUTBD TRACK/SURFACE ELECTRICAL POWER AC BUS1 AC ESS RIGHT FU\P.OUTBD TRACK/SURFACE ElECTRICAL POWER AC BUSt ACESS LEFT RUDDER CABLE HYDRAULIC POWER 1f1.#2&13 RIGHT RUDDER CABLE HYDRAULIC POWER 1f1,#2&13 lEFT ELEVATOR CABLES HYDRAUUC POWER 1f1&13 Note 1 RIGHT ELEVATOR CABLES HYDRAULIC POWER #2&13 Note 1 CHAN1 PITCHTRIM CONTROLJPOWER ELECTRICAL POWER AC BUS1 Note 2 DCBUS1 CHAN2 PITCHTRIM CONTROLJPOWER ElECTRICAL POWER ACESS Note 2 OCESS

FLIGHT CONTROLS SYSTEM LOADING Note 1:

Same fragment path must notsever.

ON-SIDE cables+OFF-SIDE hydrauUcsystem+HYDRAULIC PWR13

e.g.: Left elevator cable andHYDRAULICPWR #2 and13 or, Right elevator cable andHYDRAULICPWR#1and #3 Note 2:

Same fragment path must not sever:

BothCHAN1 andCHAN2 circuits ON-SIDE contml circuft+OFF-SIDE powercircuft OFF-SIDE control c1rcuft+ ON-SIDE powercIrcu~ FIGURE 2 EXAMPLE. SYSTEM LOADING MATRIX 15 - - - - -

### Page 40

AC 20-128A Appendix 1 Reduced 1/3 Blade Heighl Diameler Original Diameler Sector Centroid Limilof swept Palh Reference Angle for all Rolors -..----------._--------.- Trajectory Limit of swepl Path Rolor Disk Locus of Centroid 3/25/97 ~.o---- Rolalion RGURE3 TRI-5ECTOR ROTOR BURST 16 -- -------- ~

### Page 41

HYDRAUUC SYSTEM N02 {pRESS., RETURN.BRAKE 2J 3/25197

•GEN 1 KYORAUUC SYSTEM NO.1 (PRESSURE, RETURN) RueOER Ui 2X ELEVATOR LH 2X MOTIVE flOW

**FUEL FEED**

H-STABTRIM HYDRAUUC SYSTEM NO.3 PRESSURE'" RETURN o 0

•GEN2 H-STAB TRIM CH1 0::------ TAIL TANK o TRANSFER.

REFUEUOEFUEL AC 20-128A Appendix 1 FIGURE 4

TYPICAL LAYOUT OF SYSTEMS IN ROTOR PLANE 17 ~

### Page 42

AC 20-128A Appendix 1 3/25/97 VIEW LOOKING FORlNARD , Rotation --7-i>

**RIGHT RUODER CABLES**

RIGHT ELEVATOR CABLES -----.-----J ,, ----------------_ ..

-._.._...•.__.- ;

j

LEFT ELEVATOR CABLES LEFT RUDDER CABLES !

f------------------ ,r EXAMPLE:

The right rudder cables ere cut by e 1/3 fan frogmenl from the right engine at aUtrojOdory angles between

221. and 240., TrejOdory renge A. B Istherefore 18.

**FIGURES**

TRAJECTORY RANGE PLOTTING 18 _

### Page 43

Appendix 1 ...-.::..

1R .

.......•......

..........

..........

--.; SWEPT :-•: PATH 2R :. '• •• •

LOCUS OF i - … i

CENT~~ \.~-.•.~.:~;.../ TARGET T1 T2 ...................

...........

T2

FIGURES TYPICAL TRAJECTORY PLOmNG 19 ' ~ ' '

### Page 44

AC 20-128A Appendix 1 3/25/97 I

**FRAGMENT**

SWEPT PATH PLANE OFROTAnON

TRANSLATJOHALRELEASE "'.

SPREAD RISK ANGLE 7PLANE NOR:L TO PLANE OF ROTAT10N FIGURE 7 DEFINITION. THREAT WINDOW 20

### Page 45

ENGINE:

RIGHT COMPONENT:

SIZE: In.

ENGINE ROTOR FAILURE. SYSTEM EFFECTS H.P. TURBINE 1 w --N '"--'!>....• ~m':~,ltt" ';t.p w"", wlM~H~iN<'f~fl~~n~¥JB~ 280 21S 2" 295 300 30li 310 3Hi

TRAJECTORY ANGLES INDEGREES 215 220 ns" 230 '23$ 240 245 2~ 255 200 265 210 275 50 i3;ro I 10 '<1 '":u- "•••••12 18 A 'i~ '27 7i "jij IN OUT 210 l U 52 R n 311 L 43 ~1 R 7 4t 2 52 &0 , II 47 tlu CABLES CABLES PLUMBIHQ;

POWER CtW*lEIJ CHANNel' --'-I ""Ii "PLUMBiNO • 2 PLUMBING f3 MaiNE FIREUl MGlNE fiREXl2 ,PU FIREX ENGIHE fEED' ....olIVE" > '* ENGINEfEED FLOW R!l1 "PUff-ED TAIL TANK ,- ::REFUEL ILINU TRANSFER.

GENERATOR~:,<:. .1:

i_i_:t'i~A;-;>;-~. :~i}:':::~t BATTeRY-" "'~_'IAAJN'" AU' CABIN PRES lIRE", .y •• PNEU~TJC_,[~,;;!Olli-':::~ SUPPLY' :/:;;':;;5TAGE' '.' R ~L R ENG1N!!: c()" "~:-':"::"'-<:',:"

;c .• """b., • OPPOSITE N CfUE .- ...«:< :q'.:"

**APU ENCLO URE**

•••• T•• TFUU PCi'WEii RUODER

ELEVATOR fLIGHT

**CONTROLS**

HYORAULIC POWER fiRE

PROTECTION fUEL

**ELECTRICAL POWER**

ENVIRON- MENTAL POWER PLANT APU LEGEND: OIRECT HrT 0ססoo. OPPOSITE ENGINEFUELLINE XXXXX. OPPOSITEGENERATOR FFFFF. APU FUel LINE FIGURE 8 • SAMPLE ROTOR STAGE PLOTTING CHART -6"~"01\) gC?a. •.• _. '"

•••- ~ ' ~ ~ ~ ' _ "' ~~

---
OpenAirDocs.org is an independent research project of [Contrail Labs](https://contraillabs.com/). It is not affiliated with the FAA or the NTSB. Source documents are U.S. government works in the public domain.